I feel like hashed passwords are somewhere in between “completely okay to publish” and secret.

With good crypto, it should be difficult to make a password hash useful even if it is public. (Although weak passwords can make this worse if salts are also made public.) However as part of a defense in depth strategy, you probably don’t want to release them publicly.

I feel like there are different levels of secrecy at play here. I think the article means things more like ssh keys or api keys specifically.